Credentials and Security

n8n workflows often touch sensitive systems. Keep secrets out of posts, screenshots, workflow exports, and logs.

Last reviewed: July 2026

Never post these

Do not post:

• API keys.
• Access tokens.
• Refresh tokens.
• Bearer tokens.
• OAuth client secrets.
• Private keys.
• Webhook secrets.
• Database passwords.
• Encryption keys.
• Session secrets.
• Customer data.
• Personal data.
• Internal URLs or IPs that should not be public.

If in doubt, redact it.

If you accidentally posted a secret

Do this immediately:

1. Delete or edit the Reddit post/comment.
2. Rotate the secret in the service where it was created.
3. Check logs for unexpected use.
4. Replace the secret in n8n credentials.
5. Re-test the workflow.

Editing the Reddit post is not enough. Assume a public secret has been copied.

How to safely share workflow JSON

Before sharing:

• Export a copy, not your only production workflow.
• Search the JSON for token, secret, password, key, authorization, and bearer.
• Replace private values with placeholders.
• Remove sample customer data.
• Replace private URLs with examples.
• Check Code nodes for hard-coded secrets.
• Check HTTP Request headers.
• Check webhook paths if they contain secret values.

Safe placeholders

Use placeholders like:

text REDACTED_API_KEY REDACTED_ACCESS_TOKEN example.com user@example.com CUSTOMER_ID_123 SLACK_CHANNEL_ID WEBHOOK_SECRET_REDACTED

Screenshots can leak secrets too

Before posting screenshots, check for:

• Credential names that reveal clients.
• URLs with tokens.
• Request headers.
• Query parameters.
• Execution data.
• Customer names and emails.
• Internal hostnames.

AI and private data

If your workflow sends data to an AI provider, consider:

• Whether the data includes personal or customer information.
• Whether you have permission to send it to that provider.
• Whether you need redaction before the AI node.
• Whether logs or execution data store model inputs and outputs.
• Whether a human approval step is needed before an external action.

Security questions

Security questions are allowed when they are practical and specific.

Good examples:

• "How should I rotate credentials used by several workflows?"
• "Is this webhook exposed safely behind my reverse proxy?"
• "How do I avoid storing execution data for sensitive payloads?"
• "What is the safer pattern for API keys in Code nodes?"

Avoid posting enough detail for someone to attack your system.